Appl. No: 09/7§9,089 

Amdt. Dated Oct. 18, 2004 

Reply to Office action mailed: June 16, 2004 

Amendments to the Claims: 

This listing of claims will replace all prior versions and listings of claims in the 
application: 

Listing of Claims: 

1. (Currently Amended) In a computer network, a method for maintaining an 
acceptable use policy comprising: 

[[a.]] monitoring transport layer network communications , wherein each 
network communication comprises multiple half sessions ; 

[[b.]] storing at least some of said commun i cations half sessions on disk, even 
when the communication does not conform to a known protocol ; 

[[c.]] testing the stored communication for the presence of at least one 
preselected criterion; 

[[d.]] deleting the communication if the presence of said at least one 
preselected criterion is not determined; and 

[[e.]] storing the communication if the presence of said at least one 
preselected criterion is determined. 

2. (Previously Presented) The method of claim 1, wherein the preselected 
criterion comprises one or more subject matter categories. 

3. (Previously Presented) The method of claim 2, wherein at least some of said 
subject matter categories comprise regular expressions. 

4. (Previously Presented) The method of claim 3, wherein said regular 
expressions are weighted. 

5. (Canceled). 
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6. (Previously Presented) The method of claim 2, wherein the preselected 
criterion is weighted. 

/.(Previously Presented) The method of claim 4, wherein said regular 
expressions are weighted with either positive or negative values. 

8. (Previously Presented) The method of claim 7, wherein regular expressions 
within a subject matter category having a negative value are before regular 
expressions having a positive value. 

9. (Previously Presented) The method of claim 4, further comprising prioritizing 
the order in which regular expressions within a subject matter category are tested. 

10. (Previously Presented) The method of claim 9, wherein said prioritizing 
reduces the likelihood of false hits. 

11. (Previously Presented) The method of claim 1, where the computer network 
is a TCP/IP network. 

12. (Previously Presented) The method of claim 1, wherein the computer 
network is a wide area network. 

13. (Previously Presented) The method of claim 1, wherein the computer 
network is a local area network. 

14. (Previously Presented) The method of claim 2, wherein the presence of the 
preselected criterion in at least one of said categories comprises a match in a plurality 
of categories. 

15. (Previously Presented) The method of claim 2, wherein said subject matter 
categories comprise key words. 
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16. (Previously Presented) The method of claim 15, wherein at least some of 
said key words are defined by the user. 

17. (Previously Presented) The method of claim 2, further comprising assigning 
a threshold value to each subject matter category. 

18. (Previously Presented) The method of claim 17, wherein at least some of 
said subject matter categories comprise one or more predetermined expressions. 

19. (Previously Presented) The method of claim 18, further comprising assigning 
a value to said predetermined expressions. 

20. (Previously Presented) The method of claim 19, further comprising summing 
the values of said predetermined expressions. 

21. (Previously Presented) The method of claim 20, wherein said 
communication is further stored if the sum of the values of said predetermined 
expressions comprising a subject matter category equal or exceed the threshold value 
assigned to said subject matter category. 

22. (Previously Presented) The method of claim 21, wherein the threshold value 
of at least one subject matter category comprises equaling or exceeding the threshold 
value in a plurality of subject matter categories. 

23. (Previously Presented) The method of claim 21, wherein said threshold 
values assigned to said subject matter categories are variable. 

24. (Previously Presented) The method of claim 18, wherein said subject matter 
categories have a hierarchical relationship. 

25. (Currently Amended) The method of claim 24, wherein said hierarchical 
relationship comprises defining the thr e shhold threshold value for at least one subject 

4 



\\\BO - 21738/0002 - 171235 v1 



Appl. No: 09/759,089 

Amdt. Dated Oct. 18,2004 

Reply 'to Office action mailed: June 16, 2004 

matter category as the presence of predetermined expressions in a plurality of other 
subject matter categories cat e rog ie s . 

26. (Currently Amended) The method of claim 24, wherein said hierarchical 
relationship comprises defining the threshold throshhold value for at least one subject 
matter category as matching or exceeding the threshold value assigned to a plurality 
of other subject matter categories. 

27. (Previously Presented) The method of claim 1 , further comprising outputting 
a report relating to the presence of said at least one preselected criterion. 

28. (Previously Presented) The method of claim 27, wherein said report 
identifies individuals whose use of the computer network included communications 
which matched preselected criterion. 

29. (Previously Presented) The method of claim 27, wherein said report 
identifies network addresses where communications were received or originated that 
included matched preselected criterion. 

30. (Previously Presented) The method of claim 2, further comprising 
outputting a report relating to the presence of preselected criterion, wherein said report 
identifies the number of matches in a category. 

31 .(Previously Presented) The method of claim 30, wherein said report is in a 
graphical format. 

32. (Previously Presented) The method of claim 27, wherein said report 
provides the text of all communications that match said preselected criterion. 

33. (Previously Presented) The method of claim 27, wherein said report is in a 
human readable format. 
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34. (Currently Amended) A method for monitoring and maintaining an 
acceptable use policy for computer network usage comprising: 

[[a.]] capturing data on a network , wherein the data comprises multiple half 
sessions of transport layer network communications ; 

[[b.]] removing data content that does not contain language elements; 

[[c.]] testing the remaining content for the presence of predetermined 
expressions; 

[[d.]] maintaining a sum of values associated with said predetermined 
expressions found within at least one category; and 

[[e.]] storing the remaining data if the sum of values associated with said 
predetermined expressions within a category meets or exceeds a threshold value. 

35. (Previously Presented) The method of claim 34, wherein said computer 
network is a wide area network. 

36. (Previously Presented) The method of claim 34, wherein said computer 
network is a local area network. 

37. (Previously Presented) The method of claim 34, wherein said computer 
network is a TCP/IP area network. 

38. (Previously Presented) The method of claim 34, wherein said expressions 
are weighted. 

39. (Previously Presented) The method of claim 38, wherein said expressions 
are weighted with either positive or negative values. 
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40. (Previously Presented) The method of claim 39, further comprising 
prioritizing the order in which regular expressions within a subject matter category are 
tested. 

41 .(Previously Presented) The method of claim 40, wherein the negative valued 
regular expressions are tested first. 

42. (Previously Presented) The method of claim 41, wherein said negative and 
positive valued regular expressions are separately tested in the order of largest value 
to smallest value. 

43. (Previously Presented) The method of claim 40, wherein the order of said 
prioritizing is determined based upon reducing the likelihood of false hits. 

44. (Previously Presented) The method of claim 34, wherein said expressions 
include regular expressions. 

45. (Previously Presented) The method of claim 34, wherein the threshold value 
for at least one category comprises meeting or exceeding the threshold value for a 
plurality of other categories. 

46. (Previously Presented) The method of claim 34, wherein the threshold value 
of at least one category comprises meeting or exceeding the threshold value for at 
least one other category and not meeting or exceeding the threshold value for at least 
another category. 

47. (Previously Presented) The method of claim 35, wherein said threshold 
value for a category is variable. 

48. (Previously Presented) The method of claim 34, further comprising 
outputting a report relating to the presence of predetermined expressions. 
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49. (Previously Presented) The method of claim 48, wherein said report 
identifies individuals whose use of the computer network included communications 
which matched predetermined expressions. 

50. (Previously Presented) The method of claim 48, wherein said report 
identifies network addresses where communications were received or originated that 
included matched predetermined expressions. 

51. (Previously Presented) The method of claim 34, further comprising 
outputting a report relating to the presence of predetermined expressions, wherein 
said report identifies the number of matches in a category. 

52. (Previously Presented) The method of claim 50, wherein said report is in a 
graphical format. 

53. (Previously Presented) The method of claim 48, wherein said report 
provides the text of all communications that match said predetermined expressions. 

54. (Previously Presented) The method of claim 48, wherein said report is in a 
human readable format. 

55. (Currently Amended) A method for monitoring and maintaining an 
acceptable use policy for computer network usage comprising: 

[[a.]] capturing data on a network; 

[[b.]] removing data content that does not contain language elements; 

[[c.]] defining categories with weighted predetermined expressions; 

[[c.]] testing the remaining content for the presence of predetermined 
expressions; 
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[[d.]] maintaining a sum of values associated with said predetermined 
expressions found within each category; and 

[[e.]] storing the remaining data if the sum of values associated with said 
predetermined expressions present within a category exceeds a threshold value. 

56. (Previously Presented) The method of claim 55, wherein said remaining data 
is stored only if the sum of predetermined expressions exceeds the threshold value in 
a plurality of categories. 

57. (Previously Presented) The method of claim 55, wherein the threshold value 
for a category is defined as the presence of no predetermined expressions. 

58. (Previously Presented) The method of claim 55, wherein said computer 
network is a wide area network. 

59. (Previously Presented) The method of claim 55, wherein said computer 
network is a local area network. 

60. (Previously Presented) The method of claim 55, wherein said computer 
network is a TCP/IP area network. 

61. (Previously Presented) The method of claim 55, further comprising 
outputting a report relating to the presence of predetermined expressions whose sum 
meets or exceeds the threshold value of a category. 

62. (Currently Amended) The method of claim [[55]] 61, wherein said report 
identifies individuals whose use of the computer network included communications 
which contained predetermined expressions whose sum matched or exceeded the 
threshold value of at least one category. 

63. (Currently Amended) The method of claim [[55]] 61, wherein said report 
identifies network addresses where communications were received or originated that 
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included predetermined expressions whose sum matched or exceeded the threshold 
value of at least one category. 

64. (Currently Amended) The method of claim 63, wherein said r e ports ar e 
report is in a graphical format. 
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